fix(deps): update module github.com/lestrrat-go/jwx/v3 to v3.3.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/lestrrat-go/jwx/v3	v3.1.1 → v3.3.0

---

Release Notes

lestrrat-go/jwx (github.com/lestrrat-go/jwx/v3)

v3.3.0

Compare Source

Security fix for GHSA-4cf7-xm37-g63h.

Custom claim, header, and JWK field names are now JSON-escaped on output.
Previously a name was written between the quotes as is, so a name containing
" could close its own member and add members the application never set.
For example, calling Set with the name x":0,"admin produced a signed
token containing "admin":true. Every name now yields exactly one member,
and names that need no escaping serialize exactly as before.

See the Changes file for guidance on screening caller-supplied names.

Fixed in v4.5.0 and v3.3.0. v2, v1, and v0 are unmaintained and will not
receive a fix.

For more detailed release notes, see Changes.

What's Changed

• build(deps): bump actions/stale from 10.4.0 to 11.0.0 by @​dependabot[bot] in #​2280
• build(deps): bump github/codeql-action from 4 to 4.37.3 by @​dependabot[bot] in #​2283
• build(deps): bump github/codeql-action from 4.37.3 to 4.37.4 by @​dependabot[bot] in #​2287
• build(deps): bump github/codeql-action from 4.37.4 to 4.37.5 by @​dependabot[bot] in #​2290
• build(deps): bump github/codeql-action from 4.37.5 to 4.37.6 by @​dependabot[bot] in #​2293
• build(deps): bump github/codeql-action from 4.37.6 to 4.37.7 by @​dependabot[bot] in #​2301
• build(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 by @​dependabot[bot] in #​2299
• build(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 by @​dependabot[bot] in #​2306
• build(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 by @​dependabot[bot] in #​2316
• build(deps): bump github.com/lestrrat-go/dsig from 1.3.0 to 1.4.0 by @​dependabot[bot] in #​2319
• build(deps): bump github/codeql-action from 4.37.7 to 4.37.8 by @​dependabot[bot] in #​2321
• [v3] deprecate AlgorithmsForKey, move to internal by @​lestrrat in #​2326
• [v3] add jws.WithStrictECDSA sign option by @​lestrrat in #​2328
• [v3] fix curve inference claim in docs by @​lestrrat in #​2330
• build(deps): bump github/codeql-action from 4.37.8 to 4.37.9 by @​dependabot[bot] in #​2332
• add example for bounded WithWaitReady wait by @​lestrrat in #​2343
• show fetch failure cause via error sink by @​lestrrat in #​2344
• [v3] escape JSON object member names on output by @​lestrrat in #​2349

Full Changelog: lestrrat-go/jwx@v3.2.0...v3.3.0

v3.2.0

Compare Source

For more detailed release notes, see Changes.

What's Changed

• build(deps): bump github.com/lestrrat-go/dsig from 1.2.1 to 1.3.0 by @​dependabot[bot] in #​2043
• build(deps): bump golang.org/x/crypto from 0.50.0 to 0.51.0 by @​dependabot[bot] in #​2159
• build(deps): bump actions/stale from 10.2.0 to 10.3.0 by @​dependabot[bot] in #​2174
• build(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 by @​dependabot[bot] in #​2179
• build(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 by @​dependabot[bot] in #​2180
• build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @​dependabot[bot] in #​2184
• bump httprc to v3.0.6 by @​lestrrat in #​2189
• autodoc updates by @​github-actions[bot] in #​2190
• build(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 by @​dependabot[bot] in #​2192
• build(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @​dependabot[bot] in #​2226
• build(deps): bump actions/cache from 5.0.5 to 6.0.0 by @​dependabot[bot] in #​2231
• build(deps): bump actions/setup-go from 6.4.0 to 6.5.0 by @​dependabot[bot] in #​2230
• build(deps): bump actions/cache from 6.0.0 to 6.1.0 by @​dependabot[bot] in #​2238
• build(deps): bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 by @​dependabot[bot] in #​2242
• fix misspellings in code comments by @​lestrrat in #​2249
• build(deps): bump actions/stale from 10.3.0 to 10.4.0 by @​dependabot[bot] in #​2254
• build(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by @​dependabot[bot] in #​2250
• build(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by @​dependabot[bot] in #​2258
• build(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @​dependabot[bot] in #​2261
• bump x/crypto to v0.54.0 in codegen modules by @​lestrrat in #​2266
• [v3] retain unparseable JWK set keys, opt-in by @​lestrrat in #​2265
• [v3] fix per-call reject-dup-kid override by @​lestrrat in #​2270
• [v3] test jwe rejects UnsupportedKey placeholder by @​lestrrat in #​2272
• [v3] doc: recommend retain mode for third-party JWK sets as PQC rolls out by @​lestrrat in #​2274
• fix jwe JSON AAD serialization by @​lestrrat in #​2276
• add JWE authenticated data option by @​lestrrat in #​2278

Full Changelog: lestrrat-go/jwx@v3.1.1...v3.2.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 4 additional dependencies were updated

Details:

Package	Change
github.com/stretchr/testify	v1.11.1 -> v1.12.1
github.com/stretchr/objx	v0.5.2 -> v0.5.3
go.yaml.in/yaml/v3	v3.0.4 -> v3.0.5
golang.org/x/sys	v0.45.0 -> v0.47.0